diff --git a/CHANGELOG.md b/CHANGELOG.md
index b15c7f9..eba659a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,13 @@
 Changelog
 =========
 
+Version 3.6.1
+-----------------------
+
+* Fix: Warning `ini_set(): Session ini settings cannot be changed when a session is active` im Backend-Einbettungsmodus behoben, indem die REDAXO-Session unmittelbar vor dem Adminer-Include geschlossen wird.
+* Fix: CSRF-Verhalten beim Bearbeiten/Speichern im eingebetteten Adminer stabilisiert (Header- und Token-Fallback für Adminer-POSTs).
+* Fix: Adminer-URLs mit fremden `rex-api-call`/`_csrf_token`-Parametern werden beim Einstieg bereinigt, um falsche CSRF-Fehlpfade zu vermeiden.
+
 Version 3.6.0
 -----------------------
 
@@ -11,8 +18,8 @@ Version 3.6.0
 Version 3.5.5
 -----------------------
 
-Vendor-Update 5.5.1 → 6.0.0 
-Release zurückgzogen
+* Vendor-Update 5.5.1 → 6.0.0
+* Release zurückgezogen.
 
 
 Version 3.5.4
diff --git a/boot.php b/boot.php
index fe64f97..e2fa2b6 100644
--- a/boot.php
+++ b/boot.php
@@ -3,6 +3,14 @@
     {
     return; 
     }
+
+if (rex_request('page', 'string') === 'adminer' && rex_request('rex-api-call', 'string', '') !== '') {
+    $params = $_GET;
+    unset($params['rex-api-call'], $params['_csrf_token']);
+
+    rex_response::sendRedirect(rex_url::backendController($params, false));
+}
+
 // Handle adminer calls with missing page parameter
 if (rex::isBackend() && rex::getUser() && rex::getUser()->isAdmin() && isset($_GET['username']) && isset($_GET['db'])) {
     $page = rex_be_controller::getCurrentPage();
diff --git a/functions/function_adminer.php b/functions/function_adminer.php
index cad934f..8b7ab65 100644
--- a/functions/function_adminer.php
+++ b/functions/function_adminer.php
@@ -7,8 +7,18 @@
 
 function adminer_object()
 {
-    // adminer throws warning "A non-numeric value encountered" in PHP 7
-    error_reporting(error_reporting() & ~E_WARNING & ~E_NOTICE);
+    $currentErrorReporting = error_reporting();
 
-    return new Adminer();
+    // Workaround for legacy PHP 7 warnings during Adminer bootstrap.
+    if (PHP_VERSION_ID < 80000) {
+        error_reporting($currentErrorReporting & ~E_WARNING & ~E_NOTICE);
+    }
+
+    try {
+        return new Adminer();
+    } finally {
+        if (PHP_VERSION_ID < 80000) {
+            error_reporting($currentErrorReporting);
+        }
+    }
 }
diff --git a/package.yml b/package.yml
index ad893bb..1b7587d 100755
--- a/package.yml
+++ b/package.yml
@@ -1,5 +1,5 @@
 package: adminer
-version: '3.6.0'
+version: '3.6.1'
 vendor: '6.0.0 adminer'
 author: Friends Of REDAXO
 supportpage: https://github.com/FriendsOfREDAXO/adminer
diff --git a/pages/index.php b/pages/index.php
index 6625ec1..e3116a0 100644
--- a/pages/index.php
+++ b/pages/index.php
@@ -45,11 +45,26 @@
     }
 }
 
-// Adminer adjusts session settings during bootstrap. If REDAXO already has an
-// active session, this can trigger a warning from the bundled Adminer file.
-// Closing the current session before including Adminer avoids the warning.
-if (PHP_SESSION_ACTIVE === session_status()) {
-    session_write_close();
+// Adminer 6 verifies CSRF token submissions against Sec-Fetch-Site.
+// In embedded backend contexts this header can be missing or "none"
+// even for same-origin form posts, which causes false negatives.
+if (rex_request::server('REQUEST_METHOD', 'string', '') === 'POST') {
+    $secFetchSite = rex_request::server('HTTP_SEC_FETCH_SITE', 'string', '');
+    if ($secFetchSite === '' || strtolower($secFetchSite) === 'none') {
+        $_SERVER['HTTP_SEC_FETCH_SITE'] = 'same-origin';
+    }
+
+    $postedToken = rex_request::post('token', 'string', '');
+    if ($postedToken !== '' && (!isset($_SESSION['token']) || (int) $_SESSION['token'] === 0)) {
+        $tokenParts = explode(':', $postedToken, 2);
+        if (
+            count($tokenParts) === 2
+            && ctype_digit($tokenParts[0])
+            && ctype_digit($tokenParts[1])
+        ) {
+            $_SESSION['token'] = ((int) $tokenParts[0]) ^ ((int) $tokenParts[1]);
+        }
+    }
 }
 
 // deactive `throw_always_exception` debug option, because adminer is throwing some notices
@@ -60,7 +75,6 @@
 }
 
 $adminerErrorReporting = error_reporting();
-error_reporting($adminerErrorReporting & ~E_WARNING & ~E_NOTICE & ~E_DEPRECATED);
 
 // CSP für die Adminer-Seite anpassen, um inline-scripts zu erlauben
 if (method_exists('rex_response', 'setHeader')) {
@@ -69,6 +83,12 @@
 
 rex_response::cleanOutputBuffers();
 
+// Adminer adjusts session ini settings during bootstrap.
+// Ensure the REDAXO session is closed immediately before include.
+if (PHP_SESSION_ACTIVE === session_status()) {
+    session_write_close();
+}
+
 // add page param to all adminer urls
 ob_start(function ($output) {
     return preg_replace('#(?<==(?:"|\'))index\.php\?(?=username=&amp;db=|file=[^&]*&amp;version=)#', 'index.php?page=adminer&amp;', $output);